Setup Guides · Zoho Mail
Zoho Mail SPF Setup: one record, the right include and the 10-Lookup Trap
SPF is the DNS record that tells receiving mail servers which senders are allowed to use your domain. Zoho Mail's SPF setup is genuinely simple - one TXT record - and yet it is one of the most commonly broken records on Zoho-hosted domains, almost always for one of five very repeatable reasons. This guide covers the exact record, the Admin Console verification, and those five failures.
Last updated 1 August 2026 · applies to all Zoho Mail plans with a custom domain
The record
For a domain that sends only through Zoho Mail, this is the whole thing:
Host: @ Type: TXT Value: v=spf1 include:zohomail.com -all
Three details people get wrong:
- It is
zohomail.com, notzoho.com. The include target is Zoho's sending infrastructure, not their website. This mistake is common enough that it gets its own entry in the failures below. -allvs~all:-all(hard fail) tells receivers to reject anything not from Zoho;~all(soft fail) says "mark it suspicious". Zoho recommends-allwhen Zoho is your only sender. If other services also send as your domain (a CRM, a helpdesk, a newsletter tool), list them in the same record and consider~allwhile you confirm the list is complete.- One record. Ever. If your DNS already has a TXT starting with
v=spf1, you edit that record - you never add a second one. Two SPF records is a permanent error (permerror) at the receiver, and your mail is judged as if you had no SPF at all.
The setup, step by step
1 Check what you already have
Before touching anything, look up your current SPF with the free SPF checker. If a record exists (old provider, website builder, a previous admin), note every include: in it - you are about to merge, not replace, if any of those senders are still real.
2 Publish the TXT record at your DNS host
At your DNS provider (where your nameservers point - not necessarily where you bought the domain), add or edit the TXT record on the bare domain (host @) with the value above. If other services legitimately send as your domain, they join the same record, for example:
v=spf1 include:zohomail.com include:_spf.yourcrm.com ~all
3 Verify inside Zoho
Sign in to the Zoho Mail Admin Console as Administrator or Super Administrator, open Domains in the left pane and select your domain, then go to Email Configuration → SPF and click Verify SPF Record.
DNS changes usually propagate in minutes but can take longer depending on the old record's TTL. If Verify fails immediately after publishing, wait and retry before changing anything.
4 Prove it end to end
Zoho's Verify button confirms the record exists - it does not prove real mail passes. Send one message to Postbox Mailtester (Free Email Deliverability Audit): it shows SPF pass/fail on an actual delivered email, plus DKIM, DMARC alignment, blacklists and rendering in the same report.
The five failures that actually break Zoho SPF
1. Two SPF records
The classic. An old provider's record was never removed when the domain moved to Zoho, or a website plugin added its own. Receivers hit two v=spf1 TXTs, declare permerror, and treat the domain as having no SPF. Fix: merge every legitimate sender into ONE record, delete the rest.
2. The old provider's include left behind
The single record still says include:_spf.google.com or include:spf.protection.outlook.com from the pre-migration setup. Mail works, so nobody notices - but the record now authorizes infrastructure you no longer control, and anyone who can send from that provider's shared pool as your domain will pass your SPF. Prune includes to services that still send for you.
3. include:zoho.com
Still taught by many third-party guides - and it is worse than useless: zoho.com publishes no SPF record at all, and an include pointing at a domain with no SPF record makes your entire SPF evaluate to permerror. Your record does not just fail to cover Zoho's senders; receivers treat your SPF as broken, which is worse than publishing nothing.
4. The 10-lookup limit
SPF allows at most 10 DNS lookups per check; every include: spends some. Stack Zoho + CRM + helpdesk + marketing + a legacy include and you cross the line - result: permerror, same as having a broken record. If you use several Zoho services (Mail, ZeptoMail, Campaigns), Zoho's consolidation include one.zoho.com covers them all in a single entry. For third-party stacks, count your lookups - the SPF checker counts them for you.
5. SPF passes, DMARC still fails
SPF checks the invisible envelope sender; DMARC additionally requires it to align with the From domain your reader sees. Zoho Mail sends your normal mail with an aligned envelope, so this usually just works - until a newsletter or CRM tool sends "as" your domain with its own envelope. Their SPF passes for their domain and does nothing for your DMARC. Check the full picture with a free Spoof Check.
Verify it end to end
- Record check: syntax, the right include and your lookup count with the free SPF checker.
- One-email audit: send a message to Postbox Mailtester - SPF, DKIM, DMARC alignment and the full deliverability picture.
- Spoofability: can strangers still send as your domain? Run a Postbox Spoof Check.
Frequently asked questions
Is it include:zoho.com or include:zohomail.com?
include:zohomail.com. The zoho.com variant circulates widely in third-party guides, but that domain carries no SPF record - including it makes your whole SPF return permerror, so receivers treat your record as broken.
Should I use ~all or -all?
Zoho recommends -all when Zoho Mail is your only sender. Use ~all temporarily while you are still confirming every service that legitimately sends as your domain - then tighten.
What is include:one.zoho.com?
Zoho's consolidated include covering Zoho Mail, ZeptoMail and Zoho Campaigns in a single DNS lookup - useful if separate Zoho includes are pushing you toward the 10-lookup limit.
I added the record but Zoho's Verify fails
Usually propagation (wait out the old TTL) or the record landed on the wrong host - it belongs on the bare domain (@), not www or a subdomain. Check what resolvers actually see with the SPF checker.
Does SPF alone stop spoofing?
No. SPF without DMARC is a suggestion receivers may ignore, and it never protects the visible From address by itself. Pair it with DKIM and a DMARC policy - run a Spoof Check to see your current exposure.
Primary reference: Zoho Mail Admin Help - SPF Configuration. Also in Setup Guides: Microsoft 365 DKIM (selector1/selector2) · Google Workspace DKIM.
Stuck, or want the whole domain checked in one pass?